❌

Lees weergave

↗️

v4.3.14

✇Coolify
Door: andrasbacsai

Fixes

  • Fixed standalone Docker destination setup on non-Swarm servers by creating networks with Docker's default bridge driver instead of the Swarm-only overlay driver.

Full Changelog: v4.3.13...v4.3.14

  •  
  • ↗️
↗️

v4.3.13

✇Coolify
Door: andrasbacsai

Features

  • Added a one-click Executor service template with persistent storage and health checks (#11530).

Improvements

  • Served profile avatars and project icons directly from configured S3 storage or an optional CDN, with local routes as a fallback.

Fixes

  • Fixed missing service logos in global search and the service catalog by retrying a remote source before showing the default icon.
  • Gave Sentinel startup migrations enough time to finish before Docker health checks could restart the container.
  • Fixed stale Livewire keys and refresh races that could leave domain, storage, file, log, proxy, and scheduled job controls unresponsive after list changes.
  • Preserved PostgreSQL init script identity when files were renamed.
  • Rejected single-label hostnames in application and service domains while continuing to accept IP addresses.
  • Preserved custom application container names during consistent deployments and removed containers left under legacy generated names.
  • Fixed navigation after deleting or converting services, backups, scheduled tasks, sources, storage, and destinations.

What's Changed

Full Changelog: v4.3.12...v4.3.13

  •  
  • ↗️
↗️

v4.3.12

✇Coolify
Door: andrasbacsai

Fixes

  • Applied authentication rate limits per real client behind reverse proxies and Cloudflare, preventing visitors from sharing one rate-limit bucket (#11515).
  • Reset a server's unreachable counter after a successful connection check, preventing stale failures and false unreachable alerts (#11417, closes #11416).
  • Corrected placeholder alignment in code editor fields (#11514, closes #11420).
  • Queued Cloud registration verification emails with retries, making delivery more reliable.

What's Changed

New Contributors

Full Changelog: v4.3.11...v4.3.12

  •  
  • ↗️
↗️

v4.3.11

✇Coolify
Door: andrasbacsai

Features

  • Added asynchronous DNS validation for application and service domains.
  • Added one-click service templates for HashiCorp Vault and Obsidian LiveSync CouchDB.

Fixes

  • Restored proxy connections to project networks after host reboots (#11476, fixes #11436).
  • Applied custom Docker options when applications used custom container names, honored selected rollback tags, and respected Compose stop grace periods (#11479, #11480, #11498).
  • Restored custom-format PostgreSQL backups with pg_restore (#11481, fixes #11459).
  • Removed persistent volumes when deleting application previews (#11455, fixes #11441).
  • Made Docker cleanup safe to retry and prevented missing resources from failing deletion (#11463).
  • Fixed registry pushes by updating the helper image's Docker CLI, Compose, and Buildx versions (#11461, fixes #11437).
  • Fixed service log lookup when Docker label values contained commas (#11477, fixes #11454).
  • Allowed system-wide GitHub Apps to work across teams and accepted Coolify CUIDs when updating their private keys through the API (#11453, #11468).
  • Allowed teams with unused private keys or system-wide Git sources to be deleted without removing shared sources (#11499, #11500, fixes #11494).
  • Restored clickable commit links in deployment logs (#11495, fixes #11482).
  • Cleared stale Traefik branch-upgrade warnings after the suggested branch was applied (#11496, fixes #11490).
  • Kept private-key edit dialogs working after multiple keys were deleted (#11497, fixes #11487).
  • Fixed terminal container selection when identical container names existed on different servers.
  • Refreshed service configuration after required environment variables changed.
  • Redacted dotted GitHub tokens from exported logs and prevented wide tables from overflowing their containers.

Improvements

  • Showed a toast with retry guidance when infrastructure-related Livewire requests failed.
  • Distinguished proxy restarts from proxy updates in server status indicators.
  • Made stuck-resource cleanup scalable, scheduled it automatically, and made resource deletion metadata updates atomic.

New Contributors

Full Changelog: v4.3.10...v4.3.11

  •  
  • ↗️
↗️

v4.3.10

✇Coolify
Door: andrasbacsai

Features

  • Added configurable SMTP EHLO domains for instance and team email delivery (#11398, closes #11388).
  • Added API endpoints for viewing and updating instance-wide SMTP and Resend settings.
  • Added manual upgrade controls to the Updates page and mobile navigation.

Fixes

  • Applied the configured sender name and address to SMTP, Resend, test, transactional, and password-reset emails (#11393, closes #6073).
  • Respected disabled SMTP encryption in test emails (#11384, closes #5877 and #6442).
  • Prevented Proton SMTP from folding long From headers (#11400, closes #11380).
  • Restricted API token visibility and revocation to the active team, and stopped expiration warnings for users who had left that team (#11396, closes #11390).
  • Persisted the target image and version before container recreation so upgrades kept the installed version aligned (#11401, closes #11389).
  • Restored generated Caddy labels for applications with configured domains (#11397, closes #11394).
  • Allowed domains to be added to services with an empty Compose environment section (#11407, closes #11381).
  • Marked failed or timed-out Docker cleanup executions as finished and recorded their errors (#11408, closes #11383).
  • Required explicit confirmation before invitation magic links were redeemed, preventing link scanners and previews from consuming invitations (#11413, closes #11375).
  • Aligned team-scoped API responses and project access checks across sources, servers, projects, and environments (#11405).
  • Prevented newly introduced static settings from appearing as pending deployment changes after upgrades (#11430, closes #11426).
  • Completed local resource deletion even when remote Docker or backup cleanup failed.
  • Made team membership, invitation, token revocation, and source deletion changes roll back safely when part of the operation failed.
  • Released page scroll locking before destructive confirmation actions ran, preventing stuck interfaces.

Improvements

  • Preserved the current page and query parameters when switching teams.
  • Showed warnings for pending proxy updates and unavailable Sentinel instances in server status indicators.
  • Limited team deletion to owners, assigned an owner to existing ownerless teams, and made blocking resources easier to find from the danger zone.

Full Changelog: v4.3.9...v4.3.10

  •  
  • ↗️
↗️

v4.4-rc.1

✇Coolify
Door: andrasbacsai

Release candidate

This is the first release candidate for Coolify v4.4. It is intended for testing and validation before the stable v4.4 release.

Do not use this release candidate in production without appropriate testing. Please report regressions through GitHub Issues.

Changes in next

These notes include only changes currently unique to next compared with main.

OpenID Connect and authentication

  • Added first-class OpenID Connect (OIDC) authentication, including discovery, JWKS signing-key resolution, token validation, PKCE support, and identity linking.
  • Added OIDC configuration and registration-policy controls to instance settings.
  • Added an option to automatically join OIDC users to the root team.
  • Improved OAuth login handling and profile indication for SSO accounts.

Integration tokens

  • Added team-scoped integration-token management under Security settings.
  • Added create, edit, permission, and authorization handling for integration tokens.

Settings and server management

  • Improved email-provider configuration and enforced mutually exclusive provider selection.
  • Added notification-channel enable/disable handling for Discord, email, Pushover, Slack, Telegram, and webhooks.
  • Improved Docker prerequisite and package installation, including Alpine Linux package handling.
  • Improved log-drain toggle rollback behavior and SSH multiplexing controls.

Additional improvements

  • Improved settings navigation and action-button state handling.
  • Updated bundled service templates.
  • Added broader automated coverage for OIDC, OAuth registration, integration tokens, email providers, server packages, and related settings.

Comparison: main...next

  •  
  • ↗️
↗️

v4.3.9

✇Coolify
Door: andrasbacsai

Features

  • Added an instance setting to control forced HTTPS redirects for the dashboard.

Fixes

  • Prevented DNS validation from hanging on unresponsive resolvers by adding five-second query timeouts (#11378, closes #11351).
  • Preserved active deployments when shared SSH multiplexing connections were refreshed or cleaned up (#11377, closes #11372).
  • Restored GitLab push and merge-request deployments that could fail with an HTTP 500 response (#11284, closes #11262).
  • Allowed long-running volume backups to run for up to ten hours while preserving custom timeouts on existing schedules (#11358, closes #11273).
  • Prevented SSL-enabled database containers from being left stopped during certificate ownership repair and container replacement (#11315, #11352, closes #11312).
  • Prevented OAuth provider settings from being erased when OAuth settings were re-seeded (#8210).
  • Enforced team-scoped authorization for scheduled tasks, preventing cross-team access and execution (#11239, closes #11238).
  • Prevented large bind-mounted files and oversized remote output from exhausting memory while services, tasks, logs, volumes, and configuration were read (#10960).
  • Made upgrades recover correctly when status data was temporarily unavailable after restart (#11350, closes #11347).
  • Prevented stuck container removal from blocking deployments; cleanup was deferred and retried instead.
  • Enabled compression for the dashboard over HTTPS (#10828, closes #10802).
  • Corrected S3 error email links so they pointed to the configured instance instead of localhost (#8633).
  • Fixed highlighted-button, spinner, and keyboard-shortcut contrast across custom themes (#11279).
  • Fixed account menus remaining open after clicking outside an expanded Appearance panel (#11374, closes #11373).
  • Centered icon tooltips over their triggers (#11382).

Improvements

  • Surfaced pending proxy configuration and outdated Traefik states with actionable warning indicators.
  • Made server warnings clearer, improved deployment-log scrolling, and corrected spacing in database backup settings.
  • Clarified proxy-label generation choices (#11362).
  • Clarified that saving Sentinel settings restarted Sentinel.
  • Made database and OAuth seed operations transactional to preserve existing data when seeding failed (#11360).

What's Changed

New Contributors

Full Changelog: v4.3.8...v4.3.9

  •  
  • ↗️
↗️

v4.3.8

✇Coolify
Door: andrasbacsai

Features

  • Added configurable HTTPS redirects for service applications across the dashboard, API, and MCP.

Fixes

  • Prevented members from accessing deployment, database, service, and other mutable controls, and clarified disabled control styling.
  • Fixed confirmation modal checkboxes that generated malformed Livewire bindings (#11335).
  • Kept table page-size dropdowns visible and usable near the bottom of the viewport (#11349, fixes #11336).
  • Persisted PostgreSQL public-access changes so they no longer reverted after refreshes or proxy restarts (#11348, fixes #11345).
  • Corrected Traefik redirect capture groups and selected the proper Docker network for routed Compose applications and services.
  • Reconciled proxy networks from running containers, improving routing when cached resource status was stale.

Improvements

  • Made GitHub repository and branch selectors searchable and preselected each repository’s default branch.
  • Improved active-deployment indicator contrast with solid surfaces in every state.

What's Changed

Full Changelog: v4.3.7...v4.3.8

  •  
  • ↗️
↗️

v4.3.7

✇Coolify
Door: andrasbacsai

Fixes

  • Created complete PostgreSQL, MySQL, and MariaDB dumps when “All databases” was selected, preserved multi-database selections, and honored the chosen storage when deleting backups (#11331, closes #11325).
  • Restored backup pages for applications configured with directory-only backup targets (#11332, closes #11307).
  • Made deployment cancellation reliable across the API, MCP, and preview cleanup flows, and advanced the next queued deployment after cancellation (#11330, closes #11327).
  • Fixed PostgreSQL and volume backups to S3-compatible storage on servers using non-root SSH users (#11329, closes #11304).
  • Preserved ports and existing entries when editing application and service domains or S3 endpoint URLs (#11328, closes #11320).
  • Prevented Docker cleanup from accidentally deleting images marked with the coolify.managed=true label (#8831, closes #8822).
  • Kept table dropdowns visible and correctly positioned inside scrolling or overflowing containers.

Improvements

  • Stored locally uploaded profile pictures and project icons in persistent private storage so they survived upgrades.
  • Improved clipboard copying for API tokens and other read-only fields.

What's Changed

New Contributors

Full Changelog: v4.3.6...v4.3.7

  •  
  • ↗️
↗️

v4.3.6

✇Coolify
Door: andrasbacsai

Features

  • Added full-width and centered page layout preferences.
  • Added searchable breadcrumb switching for applications, databases, and services.
  • Added an Admin navigation link for root users.
  • Added the installed Coolify version to the mobile sidebar.

Fixes

  • Correctly marked missing resources as stopped when Sentinel reported a complete empty container snapshot.
  • Fixed dropdown sizing and positioning, including trigger-width matching and viewport overflow.
  • Fixed horizontal scrolling and row borders in the database backup execution table.
  • Displayed a clear empty state when no database backup executions existed.
  • Added missing Turkish translations for Authentik and Zitadel sign-in (#9938).
  • Improved loading indicator contrast in dark mode.

Improvements

  • Replaced page-size selectors with clearer dropdown controls while retaining custom page sizes.
  • Sorted resources alphabetically in breadcrumb switchers.
  • Refined desktop header borders and breadcrumb search styling.

What's Changed

  • fix(lang): add missing keys for Authentik and Zitadel OAuth by @onurdilmen in #9938

New Contributors

Full Changelog: v4.3.5...v4.3.6

  •  
  • ↗️
↗️

v4.3.4

✇Coolify
Door: andrasbacsai

Features

  • Added project icons to dashboard cards and shared-variable project views.

Fixes

  • Restored clickable deployment-log download actions (#11306; closed #11301).
  • Fixed an error that prevented eligible teams’ danger zones from loading (#11305; closed #11303).
  • Added subscription access for Coolify Cloud team admins, correctly positioned the mobile account menu, and preserved the server-limit adjustment modal during updates.

Improvements

  • Standardized pagination, page-size controls, and responsive filter and sorting menus across resource lists.
  • Constrained the deployment log viewer’s desktop height for easier navigation.

What's Changed

Full Changelog: v4.3.3...v4.3.4

  •  
  • ↗️
↗️

v4.3.3

✇Coolify
Door: andrasbacsai

Features

  • Added custom project icons with local and S3-backed storage.
  • Added configurable CPU limits for volume-backup compression.

Fixes

  • Fixed the What’s New dialog failing to open from the account menu (#11261, fixes #11219).
  • Fixed PostgreSQL instances with SSL certificates failing to start because of private-key ownership (#11286, fixes #5450).
  • Fixed S3 connection tests using saved settings instead of current form values (#11297, fixes #11289).
  • Fixed inconsistent MinIO client versions across Coolify images (#11291, fixes #11288).
  • Fixed search-indexing table headers overflowing domain tables (#11275, fixes #11263).
  • Fixed Sentinel restarting after it had been disabled (#11298, fixes #11280).
  • Allowed more startup time before Coolify health checks marked the container unhealthy (#11299, fixes #11277).
  • Fixed databases disappearing from counts and resource operations when different database types shared the same numeric ID (#11300, fixes #11285).
  • Fixed Traefik network labels for Docker Compose services without a user-selected network.
  • Fixed PostgreSQL custom-format backup uploads being rejected by SQL safety validation.
  • Fixed Compose environment variables that referenced themselves becoming uneditable.
  • Fixed stopped resources retaining stale running states.
  • Fixed deployment logs losing the manually selected follow mode and showing filtered lines.
  • Fixed S3 endpoint normalization, validation feedback, and partial numeric host editing.

Improvements

  • Made volume and full-database backups faster by using parallel gzip compression when available.
  • Prevented deletion of Compose-managed persistent volumes and improved persistent-volume management.
  • Improved mobile application links, backup screens, loading states, and validation feedback.
  • Clarified application image-retention cleanup options.

What's Changed

New Contributors

Full Changelog: v4.3.2...v4.3.3

  •  
  • ↗️
↗️

v4.3.2

✇Coolify
Door: andrasbacsai

Features

  • Added a one-click Jean Server template with configurable tokens and allowed origins (#11248).

Fixes

  • Allowed long-running backups and scheduled tasks to honor their configured SSH timeouts, including S3 uploads (#11183, closed #8435).
  • Restored built-in Coolify database backups and other scheduled jobs whose legacy records used ID 0 (#11249, closed #10623).
  • Corrected application and database container memory charts to display megabytes instead of raw bytes (#11247, closed #11246).
  • Replaced deprecated Docker stop flags with version-aware options for older and newer Docker engines (#11251, closed #11244).
  • Made upgrades wait for the restarted instance and target version before reporting success, including upgrades from older releases.
  • Stopped suggesting unconfigured www counterpart domains and corrected domain guidance and mobile domain visibility.
  • Prevented nested controls in new-resource cards from accidentally triggering deployment.

Improvements

  • Unified application, service, database, and server headings with responsive action menus.
  • Made resource, environment, and new-resource cards fully clickable, and displayed domains in resource grids (#11231, #11227).
  • Improved API token input and empty states (#11226, #11224).
  • Clarified health check wording (#11232).
  • Reduced layout shifts and added smoother notification event selector transitions.

What's Changed

Full Changelog: v4.3.1...v4.3.2

  •  
  • ↗️
↗️

v4.3.1

✇Coolify
Door: andrasbacsai

Coolify v4.3.1

Features

  • Added persistent “Changes pending” warnings to the desktop and mobile navigation bars, including change counts and direct access to configuration differences.

Fixes

  • Ensured HTTP Basic Auth updates made through the Applications API regenerated managed deployment labels while preserving custom labels (#11196, closed #11191).
  • Fixed a 500 error on volume backup pages when database backup execution logs were present (#11210).
  • Removed duplicate borders from CPU and memory metrics tooltips (#11213, closed #11212).
  • Repaired environment and project settings page headers (#11204).
  • Corrected the German password-reset email translation (#9680).
  • Updated error pages to use the correct Coolify-branded background glow.

Improvements

  • Redesigned terminal target selection and improved filtering and mobile controls (#11203).

What's Changed

  • fix(release): preserve tags when publishing draft releases by @andrasbacsai in #11199
  • feat(workflows): add pull request branch management workflow by @ShadowArcanist in #11193
  • fix(lang): correct german translation for password reset email by @EchterTimo in #9680
  • fix(ui): remove duplicate metrics tooltip border by @nexmoe in #11213
  • fix(models): add datetime cast for finished_at in ScheduledDatabaseBackupExecution by @ejscheepers in #11210
  • fix(ui): environment settings broken header & project settings header by @yk-sgr in #11204
  • fix(ui): terminal page design by @yk-sgr in #11203
  • fix(api): regenerate basic auth labels after updates by @drewmt in #11196

New Contributors

Full Changelog: v4.3.0...v4.3.1

  •  
  • ↗️
↗️

v4.3.0

✇Coolify
Door: andrasbacsai

Let us know what you think about the new UI here: #11195

Breaking Changes

  • Team members with the Member role became read-only. They could still view team resources and configuration, but could no longer create, update, delete, deploy, start, stop, or otherwise modify resources. Review team roles and promote users who still require write access (v4.2.0).
  • State-changing API endpoints began requiring POST; legacy GET requests now return 405 Method Not Allowed. This affected /enable, /disable, /deploy, server validation, application/database/service lifecycle actions, and service-application lifecycle actions (v4.2.0).
  • Changed proxy router names for Compose services containing dots or hyphens to use a stable suffix; custom references to previous router names must be updated (#11040).
  • Removed confirmation dialogs for deploy, redeploy, and force-deploy actions; these actions began immediately when selected (#11023).

Features

  • Added a redesigned interface with clearer navigation, improved domain management, DNS checks, and automatic Cloudflare DNS setup (#11119).
  • Added scheduled backups for persistent volumes and directory mounts, with local or S3-compatible storage, retention controls, on-demand runs, history, and API management (#10946, closed #7701).
  • Added per-domain search engine indexing controls (#10908).
  • Added support for deploying private repositories from self-hosted GitLab instances (#10538).
  • Added diagnostics and deployment controls to the Coolify MCP server (#11000).
  • Added profile pictures backed by local or S3-compatible storage.
  • Added Buzz, Celld, InfluxDB, Stalwart, and Termix one-click services (#11020, #11155, #11103, #10984, #11090).
  • Added an early development preview of the next-generation infrastructure experience (#10987).
  • Added team-member two-factor authentication status to the team view (#11192).

Fixes

  • Fixed S3 storage connections on servers without IPv6 (#11061, closed #11059).
  • Fixed backup uploads to S3 endpoints that also resolved to IPv6 (#11028).
  • Fixed Compose domains and environment variables for service names containing dots or hyphens (#11040, closed #10658).
  • Fixed application duplication, rollback image handling, and protection of sensitive API settings (#11003).
  • Fixed errors after deleting GitHub or GitLab source apps (#11105).
  • Fixed clearing all resource domains so it no longer caused a type error (#11083, closed #11030 and #11079).
  • Fixed www redirects for applications using Traefik.
  • Fixed Firefly III health checks (#10475).
  • Fixed the top bar appearing beneath open service action menus (#11197).

Improvements

  • Simplified new-resource creation with clearer choices and updated icons (#11140).
  • Improved dashboard metrics, status visibility, global search, mobile layouts, accessibility, and theme customization.
  • Combined database and storage backup schedules into one easier-to-manage page.
  • Shared the service template catalog across app nodes and made template downloads more reliable (#11094).
  • Reduced LiteLLM's default resource usage (#10698).
  • Updated SparkyFitness, OpnForm, and Forgejo service templates (#9927, #10600, #10639).
  • Updated Traefik security patch versions and added Traefik 3.7 support (#11029).
  • Updated Cloudflare Tunnel to address two critical security vulnerabilities (#11145).

What's Changed

New Contributors

Full Changelog: v4.2.0...v4.3.0

  •  
  • ↗️
↗️

v4.2.0

✇Coolify
Door: andrasbacsai

⚠️ Breaking Change

  1. Team members with the Member role now have read-only access. They can continue to view team resources and configuration, but can no longer create, update, delete, deploy, start, stop, or otherwise modify resources. Review your team roles before upgrading and promote users who still require write access.

  2. State-changing API endpoints now require POST. Legacy GET requests return 405 Method Not Allowed. Update API clients and deploy webhooks that use these endpoints:

  • /enable
  • /disable
  • /deploy
  • /servers/{uuid}/validate
  • /applications/{uuid}/start
  • /applications/{uuid}/restart
  • /applications/{uuid}/stop
  • /databases/{uuid}/start
  • /databases/{uuid}/restart
  • /databases/{uuid}/stop
  • /services/{uuid}/start
  • /services/{uuid}/restart
  • /services/{uuid}/stop
  • /services/{uuid}/applications/{app_uuid}/start
  • /services/{uuid}/applications/{app_uuid}/restart
  • /services/{uuid}/applications/{app_uuid}/stop

Features

  • Added scheduled persistent-volume and application-storage backups, including retention controls, manual execution, and API schedule deletion. (#10946, fixes #7701)
  • Added API endpoints for database, service, and container logs, including optional timestamps. (#6293)
  • Added API endpoints to move applications, databases, and services between authorized environments. (#8968)
  • Added a configurable Docker registry URL. (#9017)
  • Added API management for service applications and service databases, including lifecycle actions and logs. (#9249)
  • Added tag management and tag assignment during application, database, and service creation. (#9275)
  • Added Hetzner firewall, internal network, and backup options during server creation. (#9646, fixes #9619)
  • Added preview deployment settings to application API endpoints. (#10188)
  • Added REST API endpoints for listing, creating, inspecting, and deleting destinations. (#10405)
  • Added Vultr cloud server provisioning and power controls. (#10533)
  • Added an Inngest one-click service template. (#10612)
  • Added a per-team toggle for the MCP server. (#10771)
  • Added internal endpoint controls with protected DNS resolution for webhooks. (#10835)
  • Added DigitalOcean Droplet provisioning. (#10871)
  • Added scheduled ClickHouse backups and cloud administration commands.
  • Added dedicated server, cloud credential, cloud-init, and private-key management flows.
  • Added application settings to application API responses.

Fixes

  • Enforced authorization policies consistently across the API and Livewire, restricted sensitive operations to admins, and protected secrets from team members. (#8628)
  • Populated Docker Compose domains correctly for applications created through the API. (#9300, fixes #9211)
  • Hid sensitive API fields by default while allowing privileged tokens with sensitive-read access to retrieve them. (#9893)
  • Prevented force=false deployment requests from incorrectly forcing cache-busting rebuilds. (#9909)
  • Ensured closed pull-request previews were cleaned up even when status updates failed. (#10180, fixes #9495)
  • Preserved full public Git repository URLs for non-GitHub hosts. (#10274)
  • Allowed the source-commit build setting through the application API. (#10551, fixes #10280)
  • Limited Grafana-specific service fields to Grafana images. (#10562, fixes #10556)
  • Corrected GitHub Enterprise App installation paths. (#10576, fixes #10573)
  • Corrected GitHub API URL derivation while preserving custom API URLs. (#10610)
  • Corrected Convex origin variables and exposed its HTTP Actions port. (#10646, fixes #7232, #7989)
  • Validated invitation magic-link tokens while preserving database-session login flows. (#10651, fixes #10633)
  • Accepted underscores in HTTP(S) domain hostnames used by the API. (#10663, fixes #10597)
  • Interpolated Railpack build-time environment variables correctly. (#10768, fixes #10736)
  • Validated environment-variable keys before saving them. (#10773)
  • Preserved deployment-key command metadata without exposing private-key commands in logs. (#10795)
  • Hardened database backup imports and file handling. (#10796)
  • Aligned resource-creation permissions across the application. (#10799)
  • Improved team resource route handling. (#10829)
  • Improved storage mount-path handling. (#10831)
  • Improved S3 storage selection, validation, and error handling. (#10832)
  • Strengthened outbound URL validation. (#10833)
  • Corrected additional release regressions and compatibility issues. (#10834, fixes #9204)
  • Improved application URL validation and preserved case-sensitive paths. (#10836)
  • Avoided invalid service preview environment-variable lookups. (#10837, fixes #10830)
  • Isolated Railpack Buildx commands from Docker client environment settings. (#10840, fixes #10769)
  • Preserved file-volume state during service parsing. (#10843, fixes #10525)
  • Removed Ray debugging hooks from production runtime paths. (#10847, fixes #6407)
  • Preserved intentionally empty service environment-variable values. (#10850, fixes #10827)
  • Honored skip flags when synchronizing pull-request preview deployments. (#10873, fixes #10870)
  • Clarified and enforced build-server hosting restrictions. (#10961, fixes #10898)
  • Hardened Vultr provisioning cleanup, cloud-provider retries, Gmail identity normalization, and cloud server status handling.
  • Fixed application configuration-change detection after settings updates.
  • Fixed backup storage defaults and required valid S3 selections.

Improvements

  • Added responsive resource navigation, mobile lifecycle actions, and consistent status badges.
  • Improved private-key creation and prevented deletion of keys still used by servers.
  • Improved cloud server provisioning by retaining instances awaiting public IP assignment and separating provider checks from SSH checks.
  • Updated EspoCRM configuration for version 10 compatibility. (#10848)
  • Updated the Alexandrie service template to version 8.10.0. (#10864)
  • Updated the Gitea Runner template. (#10566)
  • Improved contributor documentation and issue templates. (#8577)
  • Updated Laravel, Vite, Symfony, Guzzle, phpseclib, WebAuthn, and NGINX dependencies. (#10665, #10680, #10683, #10710, #10711, #10738, #10739, #10901)

Breaking Changes

  • Required POST for state-changing API operations such as start, stop, restart, deploy, enable, disable, and server validation; equivalent GET requests now return 405 Method Not Allowed.

Related issue references:

  •  
  • ↗️
↗️

v4.1.2

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Fixed private submodule authentication during deployments (#8900, fixes #2731)
  • Fixed deploy keys overwriting server root SSH keys (#10440, fixes #10203)
  • Improved fork pull request safety for preview deployments (#10457, fixes #10342)
  • Hardened API token team checks (#10505)
  • Improved image, branch, proxy, and deployment input validation (#10501, #10502, #10503, #10504)
  • Fixed generated Compose environment variables breaking preview deployments (#10186, fixes #7552)
  • Fixed registry image tags being pushed for preview deployments (#10185, fixes #7616)
  • Fixed Git repository imports for large repositories (#10528, fixes #5251)
  • Fixed GitLab SSH webhook matching with custom ports (#10479, fixes #10450)
  • Fixed log copying on non-HTTPS instances (#8942)
  • Fixed unsafe HTML showing in the log viewer (#10346, fixes #10345)
  • Fixed deployment and container log timestamps to use the server timezone (#10165, fixes #8003)
  • Fixed in-progress form edits being wiped by live updates (#10321, fixes #6062, #6354, #9695)
  • Fixed skipped service database backup links (#10527, fixes #10526)
  • Fixed S3 backup storage validation before scheduling (#10389)
  • Fixed current team deletion errors (#10353, fixes #10351)
  • Fixed self-hosted server cleanup preserving server IPs (#10480, fixes #10471)
  • Fixed API server private key updates (#10416)
  • Fixed SSH usernames with dots (#9951)
  • Fixed stale page loading cloak after navigation (#10518, fixes #10506)
  • Fixed password field keyboard focus order (#10519, fixes #10486)
  • Fixed Railpack Buildx cache metadata persistence (#10511, fixes #10507)

New Services & Templates

  • Added Healthchecks as a one-click service (#10335)
  • Fixed Garage startup by using the correct RPC secret length (#10425)
  • Updated Chatwoot support for private API inbox webhooks (#10426)
  • Fixed Hermes Agent with Web UI image tag (#10445)
  • Updated Gitea runner to v1.0.7 (#10500)
  • Fixed ownCloud trusted-domain login issues (#10508, fixes #9944)

Improvements

  • Made exposed ports optional for portless apps (#9182, fixes #9170)
  • Added configurable application restart loop limits (#9231, fixes #8669)
  • Added standalone database health check settings (#10481, fixes #10444)
  • Added resource details with easier access to UUIDs (#9756)
  • Added destination resource listings (#9757)
  • Added environment variable search (#10421, fixes #10413)
  • Moved Sentinel into its own tab and improved metrics refresh (#9544)
  • Improved the configuration changes modal for redeployments (#10461, fixes #10367)
  • Added scrollable modals for smaller screens (#9647, fixes #9618)
  • Kept long-running terminal sessions connected (#10482)
  • Added mobile terminal controls (#10498)
  • Added custom Docker DNS option support (#10516)
  • Improved the GitHub App setup flow (#10524)
  • Updated the team invitation flow (#10510)

What's Changed

New Contributors

Full Changelog: v4.1.1...v4.1.2

  •  
  • ↗️
↗️

v4.1.1

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Restricted source and private key selection to the current team (#10348)
  • Restricted environment deletion to the current team (#10349)
  • Restricted server and network selection to the current team (#10352)
  • Fixed source selection during repository setup (#10354)
  • Hardened API token permission handling (#10355)
  • Fixed service pages opening in the correct project and environment (#10358)
  • Matched manual webhooks to the exact repository only (#10361)
  • Improved GitHub App setup, installation, and reinstall flow (#10362)

New Services & Templates

  • Added Cloudflare DDNS template (#8099)
  • Added EMQX service template (#9568)
  • Added OpenObserve template (#10279, closes #6328)
  • Added Hermes Agent and WebUI one-click service (#10283)

Improvements

  • Pinned Ryot, Jellyfin, Audiobookshelf, Grocy, and Mealie to stable image versions (#10116)
  • Updated Gitea Runner to v1.0.6 (#10282)
  • Improved the configuration changes modal readability and spacing (#10365)

What's Changed (Github)

New Contributors

Full Changelog: v4.1.0...v4.1.1

  •  
  • ↗️
↗️

v4.1.0

✇Coolify
Door: andrasbacsai

Features

  • Added Railpack as a beta build pack option with build-time environment support, config merging, examples, and deployment smoke coverage (#9117, resolves #5282).
  • Added configurable application stop grace periods for manual stops, previews, and deployments (#9746, fixes #5620).
  • Added structured audit logging for API mutations, webhook events, authentication, and authorization outcomes (#9842).
  • Added per-server configurable SSH connection timeouts and exposed the setting through the API and UI (#9844).
  • Added deployment skipping for webhook commits and PR/MR titles containing [skip ci] or [skip cd] (#9861).
  • Added instance-level MCP support with read-only tools for Coolify resources and API/UI enablement controls (#9862).
  • Added application deployment configuration diff tracking so pending changes and build-impacting changes are surfaced before redeploy (#10183, fixes #8357).
  • Added a collapsible sidebar with persisted state, tooltips, and a compact team menu (#9945).
  • Added a Gitea runner service template (#9961).

Fixes

  • Fixed OAuth user matching by normalizing email addresses before lookup (#9488, fixes #9487).
  • Fixed SMTP notification validation by setting a default encryption value (#9543).
  • Fixed database backup max storage validation to allow decimal values (#9801, fixes #9794).
  • Fixed Dockerfile build pack builds by using BuildKit-supported host networking (#9811, fixes #9804).
  • Fixed generated HEX magic environment secrets so encoded values have the expected length (#9820).
  • Fixed server reachability notifications by dispatching them through an event path without blocking retry loops (#9843, fixes #9830).
  • Fixed large file-volume editing in the UI by blocking editable payloads over 5 MiB (#9851, fixes #4701).
  • Fixed deployment commit resolution to use the application git_commit_sha when no commit is explicitly provided (#9865, closes #9204).
  • Fixed database imports to allow .dmp files (#9869).
  • Fixed invalid or undecryptable Sentinel tokens by regenerating them automatically (#9874).
  • Fixed scheduled task server resolution when relationships are missing (#9922, fixes #9916).
  • Fixed preview image tags so different commits on the same PR do not reuse shared tags (#10066, fixes #5538).
  • Fixed custom nginx configuration updates from the API by correctly decoding payloads and supporting clearing the value (#10067, fixes #9975).
  • Fixed API token expiration warnings so sent-warning state persists and failed notifications can retry (#10184).
  • Fixed terminal reliability with heartbeat handling, idle timeouts, reconnect replay, and preserved scrollback.
  • Fixed deployment and log views so auto-scroll pauses when users scroll up and resumes at the bottom.
  • Fixed realtime server dependencies by replacing Axios with the native HTTP client (#10065).
  • Fixed nginx Docker images to use patched official packages and HTTPS package repositories (#10026).
  • Fixed Docmost templates to require a mail driver before startup.

Improvements

  • Improved Railpack behavior with Docker buildx validation, safer shell argument handling, scoped build-time variables, better port handling, and updated helper versions (#9117, resolves #5282).
  • Improved MCP resource listing performance and changed enable/disable routes to POST for state-changing actions (#9862).
  • Improved standalone database lookup coverage for KeyDB, Dragonfly, and ClickHouse (#9862).
  • Suppressed noisy Horizon failed-job entries for expected deployment and timeout failures on cloud instances (#9871).
  • Synced service templates from next and disabled the stale LiteQueen template (#9884, #10006).
  • Bumped follow-redirects in the realtime Docker package to 1.16.0 (#9690).
  • Bumped phpseclib/phpseclib to 3.0.52 (#9952).
  • Improved Vite dev-server host, port, and CORS configuration for local development.
  • Improved collapsed sidebar spacing, deployment indicator alignment, and environment-variable dirty indicators.

Breaking Changes

  • Removed the deprecated Docker Compose application API endpoint; service creation should use POST /api/v1/services instead.
  • Changed MCP enable/disable endpoints from GET to POST (#9862).

What's Changed

New Contributors

Full Changelog: v4.0.0...v4.1.0

  •  
  • ↗️
↗️

v4.0.0

✇Coolify
Door: andrasbacsai

Finally releasing v4.0.

It was long overdue because we have been in beta for a long time. Thousands of companies and people have been using Coolify in production for 1-2 years.

Of course, this does not mean it has no bugs, it has many, but we fix them every day.

v5 is coming together, but we are not rushing it.

The biggest feature will be full scalability in the core, so you will have cloud infrastructure, but with your own servers.

I already have a working solution for the core and it is soo cool. Can't wait to start showing them to you.

By the way, doing v5 does not mean we won't continue to support v4.
We just want to push what is possible with servers and automations.

Thank you to everyone who helped me reach this point 💜

Let's make cool stuff! 🫰

So the release notes:

What's Changed

Security & Fixes

  • Fixed Rallly service environment variable defaults (#9041, fixes #9615)
  • Fixed Logto upgrade failure caused by missing database migration step (#9376)
  • Fixed Jitsi Meet not working — rebuilt template with stable image and proper UDP/secrets (#9594, fixes #4813)
  • Fixed Twenty deployment failure from unhealthy worker dependency (#9603, fixes #9574)
  • Fixed mobile info popup not opening on tap and bubbling clicks to parent (#9809, closes #4834)
  • Fixed SPA navigation race conditions causing stale state, broken buttons, and unsaved changes (#9742, closes #9732)

New Services & Templates

  • Added Cap captcha service template (#9729)
  • Re-enabled Plane service with updated docker-compose (#9641, fixes #8338)
  • Updated Beszel and Beszel Agent to 0.18.7 (#9775)
  • Disabled Cal.com template — project went closed source (#9776)

Improvements

  • Added healthcheck to Langfuse worker (#9772)

What's Changed (Github)

New Contributors

Full Changelog: v4.0.0-beta.474...v4.0.0

  •  
  • ↗️
↗️

v4.0.0-beta.474

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Prevent data loss when persistent containers (databases, apps, services) are accidentally pruned during service deletion (#9654, fixes #9582)
  • Fix S3 storage backup endpoints returning 500 in API context (#9655, fixes #9581)
  • Encrypt manual webhook secrets and strengthen HMAC signature verification (#9652)
  • Fix Rocky Linux installer to use correct RHEL Docker repository (#9541, fixes #8730)
  • Harden authentication: upgrade email verification hash and fix invitation link login (#9672)
  • Validate and rate-limit feedback endpoint (#9653)
  • Tighten volume name and path validation with shell argument escaping (#9666)
  • Validate backup upload file type and size limits (#9667)
  • Tighten S3 endpoint URL validation (#9668)
  • Harden dev helper version validation and build argument escaping (#9670)
  • Strengthen team scoping across resource creation flows (#9651)
  • Fix SSH repository URLs with custom ports being mangled (#9425)
  • Fix healthcheck path validation rejecting commas and semicolons (#9223)
  • Fix database credential validation and shell escaping across Postgres, MySQL, MariaDB (#9674, #9676, #9681, #9682)
  • Improve shell command tokenization for install, build, and start commands (#9684)
  • Return stable generic error messages for API 5xx responses (#9669)

Improvements

  • Add optional expiration for API tokens with advance notification warning before expiry (#9677)
  • Add DELETE API endpoint to remove preview deployments by pull request ID (#9614)
  • Mark Docker Swarm support as deprecated ahead of v5 removal (#9621)
  • Categorize application advanced settings into logical sections (#9234)
  • Improve service settings layout with dedicated advanced page and clearer headings (#9027)
  • Display memory limit fields in a single row (#9232)
  • Add info callout to clone resource section listing excluded items (#9233)
  • Add architecture warning for service templates with platform limitations (#8390)
  • Improve domain port+path format documentation in the UI (#8331)

What's Changed (Github)

  • fix(installer): use RHEL Docker repo for Rocky Linux by @andrasbacsai in #9541
  • fix(dev): add Docker volume path mapping to testing-host for database deployments by @cyface in #9534
  • feat(ui): categorize application advanced settings into logical sections by @ShadowArcanist in #9234
  • feat(ui): add info callout to clone resource section about excluded items by @ShadowArcanist in #9233
  • feat(ui): display memory limit fields in single row by @ShadowArcanist in #9232
  • fix(healthcheck): user input is rejected if path contains comma and semicolon by @ShadowArcanist in #9223
  • feat(ui): improve service settings UX, headings, and helper text for clarity by @ShadowArcanist in #9027
  • feat(services): add architecture warning by @Cinzya in #8390
  • Added extra documentation on format for port+path for domains by @JamesPeters98 in #8331
  • fix(git): preserve ssh scheme URLs with custom ports by @Iisyourdad in #9425
  • refactor: tighten team scoping on resource creation and admin nav by @andrasbacsai in #9651
  • build(deps-dev): bump follow-redirects from 1.15.11 to 1.16.0 by @dependabot[bot] in #9580
  • refactor(webhook): encrypt manual webhook secrets and tighten HMAC verification by @andrasbacsai in #9652
  • feat(api): add DELETE endpoint for preview deployments by PR id by @andrasbacsai in #9614
  • refactor(api): validate and throttle feedback endpoint by @andrasbacsai in #9653
  • fix(server): exclude persistent resources from container prune by @andrasbacsai in #9654
  • fix(api): use explicit team ID for S3 storage lookup in backup endpoints by @andrasbacsai in #9655
  • refactor(volumes): validate input and escape shell args by @andrasbacsai in #9666
  • refactor(backup): validate database backup upload file type and size by @andrasbacsai in #9667
  • refactor(storage): tighten S3 endpoint URL validation by @andrasbacsai in #9668
  • refactor(settings): harden dev_helper_version validation and escape build args by @andrasbacsai in #9670
  • refactor(api): return stable generic error messages for 5xx responses by @andrasbacsai in #9669
  • [v5.x] chore: mark v4 docker swarm support as deprecated by @peaklabs-dev in #9621
  • refactor: harden auth, CLI input, and scheduled-log viewer by @andrasbacsai in #9672
  • fix(database): mount guard, healthcheck CMD exec-form, port input layout by @andrasbacsai in #9674
  • fix(database): credential format validation with dirty-value escape hatch by @andrasbacsai in #9676
  • feat(security): add expiration support for API tokens by @andrasbacsai in #9677
  • fix(database): tighten Postgres init script filename handling by @andrasbacsai in #9681
  • refactor(database): align Postgres SSL chown escaping with MySQL by @andrasbacsai in #9682
  • refactor(validation): tokenize shell-safe command pattern by @andrasbacsai in #9684
  • v4.0.0-beta.474 by @andrasbacsai in #9542

New Contributors

Full Changelog: v4.0.0-beta.473...v4.0.0-beta.474

  •  
  • ↗️
↗️

v4.0.0-beta.473

✇Coolify
Door: andrasbacsai

Fixes

  • Fixed the upgrade modal to show the correct target version and cleared stale upgrade notifications when the instance was already up to date. (#7774, fixes #6039, #8707)
  • Fixed user deletion cleanup so team-owned Git app sources were handled safely, while instance-wide sources were preserved for the root team. (#9435, fixes #8172)
  • Fixed dashboard homepage add buttons so they remained visible in light mode. (#9456, fixes #9454)
  • Fixed port mapping validation to accept protocol suffixes like /tcp, /udp, /sctp and IP-bound mappings. (#9503, fixes #9501, #9504)

Improvements

  • Updated phpseclib/phpseclib to 3.0.51. (#9500)
  • Updated axios to 1.15.0 for development dependencies. (#9515)
  • Updated axios to 1.15.0 in coolify-realtime. (#9516)

What's Changed (Github)

  • fix(ui): Initialize latestVersion in Upgrade component mount by @andrasbacsai in #7774
  • fix(user-deletion): safely clean up team-owned Git app sources by @andrasbacsai in #9435
  • fix(ui): dashboard homepage add buttons are invisible in light mode by @rosslh in #9456
  • fix(validation): allow protocol suffix and ip in port mappings (/tcp, /udp, /sctp) by @ShadowArcanist in #9503
  • build(deps): bump phpseclib/phpseclib from 3.0.50 to 3.0.51 by @dependabot[bot] in #9500
  • build(deps-dev): bump axios from 1.13.2 to 1.15.0 by @dependabot[bot] in #9515
  • build(deps): bump axios from 1.13.6 to 1.15.0 in /docker/coolify-realtime by @dependabot[bot] in #9516
  • v4.0.0-beta.473 by @andrasbacsai in #9521

New Contributors

Full Changelog: v4.0.0-beta.472...v4.0.0-beta.473

  •  
  • ↗️
↗️

v4.0.0-beta.472

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Allow quoted arguments in custom Docker run options (#9481, fixes #9343)
  • Patched Alpine packages in helper, realtime, and development Docker images (#9437)
  • Bumped Alexandrie images to address upstream security advisory (#9434)

New Services & Templates

  • Added Grimmory one-click service, the successor to Booklore (#9109)
  • Comprehensive Supabase template update to latest versions (#8316)
  • Allow overriding GOTRUE_SITE_URL in Supabase for separate frontend domains (#9079, fixes #5581)
  • Added sensible CORS defaults to Directus templates (#9081, fixes #5024)
  • Updated Rivet template to v2.2.0 (#9378)
  • Updated Convex to current latest version (#9392)
  • Fixed LibreChat healthcheck and upgraded Meilisearch image (#9358)
  • Fixed n8n task-runners health check (#9309, fixes #9306)
  • Increased Nextcloud healthcheck interval to prevent worker exhaustion (#9440, fixes #9439)
  • Updated Nextcloud healthcheck endpoint to /status.php (#9470)
  • Fixed Netbird client volume path so settings persist across restarts (#9484)
  • Corrected Minecraft template category to games (#9387)
  • Corrected several template categories that were set incorrectly (#9449)

Improvements

  • Removed Algora bounty program references from community docs and templates (#9436)

What's Changed (Github)

  • fix(services): bump images of alexandrie to fix security issue by @Smaug6739 in #9434
  • feat(service): update Convex to current latest version by @sebous in #9392
  • fix(template): Minecraft was on wrong category by @Iisyourdad in #9387
  • feat(service): update Rivet to v2.2.0 by @yipfram in #9378
  • fix(service): fix librechat healthcheck and update dependencies by @GauthierPLM in #9358
  • fix(service): n8n task-runners health check fails by @frank-netkey in #9309
  • feat(service): add grimmory by @RickyWanga in #9109
  • fix(service): directus cors not applied in preflight requests by @xidik12 in #9081
  • feat(service): update Supabase to current latest versions by @Vadko in #8316
  • fix(service): allow overriding GOTRUE_SITE_URL in Supabase template by @xidik12 in #9079
  • fix(service): nextcloud workers exhaustion due to low interval healthcheck by @ShadowArcanist in #9440
  • fix(docker): add apk upgrade to helper, realtime, and development Dockerfiles by @andrasbacsai in #9437
  • chore(community): remove Algora bounty program references by @andrasbacsai in #9436
  • chore(service): update nextcloud healthcheck endpoint by @ShadowArcanist in #9470
  • fix(validation): allow quoted docker run options in custom config by @andrasbacsai in #9481
  • build(deps-dev): bump vite from 7.3.0 to 7.3.2 by @dependabot[bot] in #9457
  • fix(service): Several templates on wrong catagory. by @Iisyourdad in #9449
  • fix(service): netbird-client wrong volume path by @iamimmanuelraj in #9484
  • v4.0.0-beta.472 by @andrasbacsai in #9492

New Contributors

Full Changelog: v4.0.0-beta.471...v4.0.0-beta.472

  •  
  • ↗️
↗️

v4.0.0-beta.471

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Harden model mass assignment protection across all models (#9282)
  • Scope server and project queries to current team (#9230)
  • Harden GetLogs component with locked properties and input validation (#9229)
  • Add validation and escaping for Docker network names (#9228)
  • Add URL validation for notification webhook fields (#9224)
  • Use server-side config for password reset URL generation (#9193)
  • Add input validation for install/build/start command fields (#9227)
  • Add input validation for resource limit fields (#9238)
  • Add IP validation for custom DNS servers input (#9239)
  • Add URL validation for proxy redirect input (#9241)
  • Add input validation for server advanced settings page (#9242)
  • Add input validation for sentinel configuration (#9243)
  • Add input validation for database backup timeout (#9245)
  • Add input validation for emails configuration (#9259)
  • Add input validation for database public port and proxy timeout
  • Add validation to block unsafe webhook URLs
  • Use random_int() for email change verification codes (#9226)
  • Move admin route into middleware group (#9225)
  • Enforce team-scoped project/env lookups in onboarding
  • Add input validation for port exposes and port mappings fields

New Services & Templates

  • Added ElectricSQL template (#8190)

Fixes

  • Fix intermittent pre-deployment command failures (#9165, fixes #9076)
  • Fix Grafana GF_SERVER_DOMAIN using FQDN instead of URL (#9080, fixes #5307)
  • Fix listmonk db config env typo (#9250)
  • Fix Langfuse by pinning ClickHouse version to avoid init errors
  • Fix cloning persistent volumes with missing uuid (#9290, fixes #9270)
  • Fix redirect value not persisting in setRedirect (#9279)
  • Fix cloud subscription notification links (#9296)
  • Fix slash branches in public repo URLs
  • Fix shared env vars resolving on wrong server
  • Fix database SSL/status state and clone writes
  • Fix auto-generate missing CA cert on SSL regeneration
  • Fix backup notification failures affecting backup status (fixes #9088)
  • Fix backup retention enforcement and stale execution cleanup
  • Fix password visibility toggle using Alpine state
  • Fix GitHub branch state when refreshing repositories

Improvements

  • Shared server environment variables (#7764)
  • Refresh repos on private GitHub app (#8621)
  • Support Docker image tags for preview deployments
  • Add preserve repository option to deployment API (#8371)
  • Implement exponential backoff for unreachable servers (#9184)
  • Improve scheduled task single view UX (#9266)
  • Add two-step confirmation to enable self-registration (#9277)
  • Add public port timeout configuration for databases
  • Make textarea monospace opt-in and improve multiline toggle

What's Changed (Github)

New Contributors

Full Changelog: v4.0.0-beta.470...v4.0.0-beta.471

  •  
  • ↗️
↗️

v4.0.0-beta.470

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Fixed proxy config validation to ensure stored config matches the current proxy type (#9146, fixes #9127)
  • Fixed environment variables being incorrectly resolved in compose files instead of preserving ${VAR} references (#9147, fixes #9136)
  • Fixed deployment issues with shell argument escaping in nixpacks commands (#9122, fixes #9042)
  • Fixed GitHub webhook errors for unsupported event types (#9119, fixes #9090)
  • Fixed server limit checks when using API tokens (#9123, fixes #9116)
  • Fixed hostname validation to be case-insensitive and allow more characters (#9134, fixes #9131)
  • Fixed duplicate subscription creation
  • Fixed environment variable refresh when variables are missing or stale
  • Fixed Docker cleanup logging when server is unreachable

New Services & Templates

  • Added EspoCRM one-click service template (#8658)

Improvements

  • Improved mobile responsiveness for confirmation modals
  • Simplified Docker installation process
  • Added storage API endpoints with UUID support for databases and services
  • Added Nightwatch monitoring support
  • Disabled Booklore service template (#9105)
  • Bumped Sentinel and Traefik versions

What's Changed (Github)

New Contributors

Full Changelog: v4.0.0-beta.469...v4.0.0-beta.470

  •  
  • ↗️
↗️

v4.0.0-beta.469

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Fixed sporadic SSH "permission denied" errors during key rotation (#8990, fixes #7724)
  • Fixed deployment failures when build server is enabled during restart operations (#9045, fixes #9013)
  • Fixed breadcrumb queries causing out-of-memory crashes (#9048, fixes #9009)
  • Fixed GitHub App webhook endpoint defaulting to IPv4 instead of instance domain (#8948)
  • Fixed Hoppscotch service failing to start due to database health check (#8949)
  • Fixed Docker Compose not respecting preserveRepository for project directory (#8956, fixes #8953)
  • Fixed backup error when S3 storage is missing or deleted (#9038, fixes #9035)
  • Fixed Stripe subscription error handling and resilience (#9030)
  • Fixed Heyform template configuration (#8747)
  • Fixed API resource UUID extraction from route parameters
  • Fixed Docker cleanup stale container warning on cloud instances
  • Fixed Compose file-not-found error now includes git branch info

New Services & Templates

  • Added LibreSpeed service for self-hosted speed testing (#8626)
  • Added imgcompress service for offline image processing (#8763)
  • Updated Databasus to v3.16.2 (#8586)
  • Updated n8n with Postgres and Worker to v2.10.4 (#8807)
  • Updated SeaweedFS images to v4.13 (#8738)
  • Fixed Castopod service port from 8000 to 8080 (#8817)

Improvements

  • Added per-volume control of PR suffix in preview deployments (#9006, fixes #7802, fixes #7343)
  • Added auto-population of FQDN from docker_compose_domains for compose previews (#8963, fixes #8958)
  • Added force deletion option for servers with existing resources (#8962)
  • Added auto-fetch of server metadata after validation (#8964)
  • Added container label escape control to services API (#8955, fixes #8954)
  • Added database environment variable management API endpoints
  • Added storage management API endpoints for applications and backup schedules
  • Added support for comments in bulk environment variable API endpoints
  • Added placeholder hints for magic environment variables
  • Added next billing date and billing interval display for subscriptions
  • Added cache-based deduplication for delayed cron execution
  • Simplified environment variable settings by removing buildtime/runtime options

What's Changed (Github)

  • fix(git): GitHub App webhook endpoint defaults to IPv4 instead of the instance domain by @ShadowArcanist in #8948
  • feat(service): update n8n-with-postgres-and-worker to 2.10.4 by @michachan in #8807
  • Change Castopod service port from 8000 to 8080 by @SeriousM in #8817
  • fix(service): hoppscotch fails to start due to db unhealthy by @ShadowArcanist in #8949
  • fix(api): allow is_container_label_escape_enabled in service operations by @andrasbacsai in #8955
  • fix(docker-compose): respect preserveRepository when injecting --project-directory by @andrasbacsai in #8956
  • feat(server): allow force deletion of servers with resources by @andrasbacsai in #8962
  • feat(compose-preview): populate fqdn from docker_compose_domains by @andrasbacsai in #8963
  • feat(server): auto-fetch server metadata after validation by @andrasbacsai in #8964
  • feat(templates): Add imgcompress service, for offline image processing by @ariqpradipa in #8763
  • fix(template): fix heyform template by @iMuFeng in #8747
  • chore(service): Update SeaweedFS images to version 4.13 by @FabioHAraujo in #8738
  • feat(service): Add librespeed by @diogo24m in #8626
  • feat(service): update databasus to v3.16.2 by @Luzefiru in #8586
  • fix(preview): enable per-volume control of PR suffix in preview deployments by @andrasbacsai in #9006
  • fix: prevent sporadic SSH permission denied on key rotation by @pannous in #8990
  • fix(stripe): add error handling and resilience to subscription operations by @andrasbacsai in #9030
  • fix(backup): throw explicit error when S3 storage missing or deleted by @andrasbacsai in #9038
  • perf(breadcrumb): optimize queries and simplify navigation to fix OOM by @andrasbacsai in #9048
  • fix(deployment): disable build server during restart operations by @andrasbacsai in #9045
  • v4.0.0-beta.469 by @andrasbacsai in #9007

New Contributors

Full Changelog: v4.0.0-beta.468...v4.0.0-beta.469

  •  
  • ↗️
↗️

v4.0.0-beta.468

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Fixed SSH connection retry failures during deployments (#8927, fixes #8926)
  • Fixed deployment type selection when using GitHub/GitLab Apps (#8934, fixes #8917)
  • Fixed deployment authorization endpoint returning incorrect 404 errors (#8931, fixes #8925)
  • Fixed shared variables not resolving in Docker Compose environments (#8930, fixes #8918)
  • Fixed SSH keys not being used for git submodule and LFS operations (#8933, fixes #8895)
  • Added support for scoped npm packages in file path validation (#8928, fixes #8924)

Improvements

  • Added log filtering capability based on log level in deployment logs (#8784)

What's Changed (Github)

Full Changelog: v4.0.0-beta.467...v4.0.0-beta.468

  •  
  • ↗️
↗️

v4.0.0-beta.467

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Fixed command injection vulnerability in health check commands (#8898)
  • Added path validation to prevent command injection in file locations
  • Fixed environment variables being overwritten when changing service domains (#8915, fixes #8912)
  • Fixed Nixpacks deployment failures when application has no domain set (#8902, fixes #6830)
  • Fixed resource deletion failing silently in the danger zone (#8909, fixes #8836)
  • Fixed scheduled task input fields losing focus while editing (#8654, fixes #8647)
  • Added docker_cleanup parameter to API stop endpoints (#8899, fixes #7758)

Improvements

  • Added GitLab source integration with SSH deploy keys and HTTP basic auth (#8910, fixes #5295)
  • Added database-backed proxy config storage with automatic recovery and versioned backups (#8905, fixes #7178)
  • Added server metadata collection and display

What's Changed

  • fix(security): sanitize newlines in health check commands to prevent RCE by @andrasbacsai in #8898
  • fix: prevent scheduled task input fields from losing focus by @sharkcreep87 in #8654
  • fix(api): add docker_cleanup parameter to stop endpoints by @andrasbacsai in #8899
  • fix(deployment): filter null and empty environment variables from nixpacks plan by @andrasbacsai in #8902
  • feat(proxy): add database-backed config storage with disk backups by @andrasbacsai in #8905
  • fix(livewire): add error handling and selectedActions to delete methods by @andrasbacsai in #8909
  • feat(git-sources): add GitLab integration and URL encode credentials by @andrasbacsai in #8910
  • fix(parsers): use firstOrCreate instead of updateOrCreate for environment variables by @andrasbacsai in #8915
  • v4.0.0-beta.467 by @andrasbacsai in #8911

New Contributors

Full Changelog: v4.0.0-beta.466...v4.0.0-beta.467

  •  
  • ↗️
↗️

v4.0.0-beta.466

✇Coolify
Door: andrasbacsai

What's Changed

Security & Fixes

  • Prevent command injection via base64-encoding log drain environment variables
  • Prevent command injection via git reference validation
  • Add sentinel token validation to prevent command injection
  • Require write permission for API validation endpoints
  • Prevent false container exits on failed docker queries (#8860)
  • Track last_online_at and reset database restart state
  • Preserve user-saved environment variables on Docker Compose redeploy (#8894)
  • Fix build-time environment variables breaking Next.js (#8890)
  • Prevent command injection in developer view shared variables (#8889)
  • Make confirmation modal close after dispatching Livewire actions (#8892)
  • Respect keep for rollback setting for Nixpacks build images (#8859)

Dependencies

  • Bump rollup from 4.57.1 to 4.59.0 (#8691)
  • Bump league/commonmark from 2.8.0 to 2.8.1 (#8793)

What's Changed

Full Changelog: v4.0.0-beta.465...v4.0.0-beta.466

  •  
  • ↗️
❌